Hello -

Assuming you return "cleansedUrl", your usage looks correct.

I recommend checking with your internal security team or Veracode administrator to ensure the Custom Cleansers functionality is enabled within your account. The security team has the ability to control what action is taken when a Custom Cleanser is encountered; by default it is set to "take no action."

Thanks for the reply, Matt. Yes, the method would return "cleansedUrl" (sorry for sloppy example). When you say the default is "take no action", does that mean do or don't honer the annotation? If "the security team" needs to enable working annotations, then I think you're saying that Greenlight will always report flaws for these, since my understanding is that there's no way for it to be configured with custom security team configuration.

Thanks,

Ken

The default "take no action" means the annotation will not be respected by the scanner. Flaws will continue to show as if no cleansing methods were used.

You are correct that custom cleansers will not be recognized by Greenlight. At this time, Greenlight has no concept of mitigations and will only report potential flaws found within the limited scope of the scan (i.e. class or package). You can use the "ignore" functionality built into Greenlight to suppress findings that rely on a custom cleanser; once you perform a full static scan, the custom cleansers will be recognized appropriately (assuming the feature is enabled).